A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file.
Weakness
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Exiv2 | Exiv2 | 0.27 (including) | 0.27 (including) |
| Red Hat Enterprise Linux 8 | RedHat | compat-exiv2-026-0:0.26-7.el8 | * |
| Red Hat Enterprise Linux 8 | RedHat | exiv2-0:0.27.5-2.el8 | * |
| Exiv2 | Ubuntu | bionic | * |
| Exiv2 | Ubuntu | hirsute | * |
| Exiv2 | Ubuntu | impish | * |
| Exiv2 | Ubuntu | kinetic | * |
| Exiv2 | Ubuntu | trusty | * |
| Exiv2 | Ubuntu | xenial | * |